Native VLAN 802.1Q Untagged Traffic Handling
In an IEEE 802.1Q trunking environment, the Native VLAN is the single, designated VLAN that traverses the trunk link without a VLAN tag. It was originally designed to provide backward compatibility with legacy hubs and switches that did not understand 802.1Q encapsulation.
Ingress and Egress Logic
When a switch needs to forward a broadcast frame that originated in the Native VLAN across a trunk port, it purposefully strips the 802.1Q tag off the frame before sending it over the wire.
When a switch receives a standard, untagged Ethernet frame on an 802.1Q trunk port, it assumes the frame belongs to its locally configured Native VLAN and dumps the traffic into that broadcast domain.
CCNA Exam Gotchas
Native VLAN Mismatches
By default, Cisco switches use VLAN 1 as the Native VLAN. If Switch A has Native VLAN 1, and Switch B has Native VLAN 99, traffic sent untagged by Switch A (intending to go to VLAN 1) will be received by Switch B and incorrectly dumped into VLAN 99. This causes spanning tree loops and breaks connectivity. CDP will continuously throw %CDP-4-NATIVE_VLAN_MISMATCH errors in the console until it is fixed.
Double-Tagging VLAN Hopping
If an attacker connects to an access port that happens to belong to the same VLAN as the Native VLAN, they can craft a malicious frame with two 802.1Q tags (e.g., an outer tag of 1, and an inner tag of 50). The first switch sees the outer tag matches the Native VLAN, strips it off, and forwards the frame across the trunk. The receiving switch sees the hidden inner tag of 50, and routes the attacker's traffic into a restricted subnet. Best practice: Change the Native VLAN to an unused, "black hole" VLAN (e.g., VLAN 999) to prevent this.